security-architecture

name	security-architecture
description	Security system design principles
license	MIT
compatibility	opencode
metadata	{"audience":"developers","category":"security"}

What I do

• Design secure system architectures
• Apply defense-in-depth principles
• Create security boundaries and zones
• Select appropriate security controls
• Model threats and attack surfaces

When to use me

When designing new systems, reviewing architecture, or improving security posture.

Security Architecture Principles

Defense in Depth

# Layered security model
SECURITY_LAYERS = [
    "Physical Security",      # Layer 1: Data center, hardware
    "Network Security",       # Layer 2: Firewalls, segmentation
    "Host Security",          # Layer 3: OS hardening, patching
    "Application Security",   # Layer 4: Code, inputs, auth
    "Data Security"           # Layer 5: Encryption, access control
]

class DefenseInDepth:
    """Multi-layered security controls"""
    
    def __init__(self):
        self.layers = {}
    
    def add_control(self, layer: str, control: str, 
                    mitigation: str):
        if layer not in self.layers:
            self.layers[layer] = []
        
        self.layers[layer].append({
            "control": control,
            "mitigation": mitigation,
            "implemented": False
        })

Zero Trust Architecture

class ZeroTrust:
    """Never trust, always verify"""
    
    def __init__(self):
        self.policies = []
    
    def verify_request(self, request: dict) -> bool:
        """Verify every request regardless of source"""
        
        # 1. Verify identity
        if not self._verify_identity(request):
            return False
        
        # 2. Verify device
        if not self._verify_device(request):
            return False
        
        # 3. Verify access level
        if not self._verify_access(request):
            return False
        
        # 4. Verify context
        if not self._verify_context(request):
            return False
        
        # 5. Continuous monitoring
        if not self._monitor_session(request):
            return False
        
        return True
    
    def _verify_identity() -> :
        
        
         request.get(, )
    
     () -> :
        
         request.get(, )  \
               request.get(, )
    
     () -> :
        
         request.get()  \
               request.get(, [])
    
     () -> :
        
        risk_score = ._calculate_risk(request)
         risk_score < 
    
     () -> :
        
         request.get(, )

Network Segmentation

class NetworkSegmentation:
    """Isolate network segments"""
    
    ZONES = {
        "dmz": {
            "description": "Public-facing services",
            "allowed_inbound": ["http", "https"],
            "allowed_outbound": ["app_layer"],
            "trust_level": "untrusted"
        },
        "app_layer": {
            "description": "Application servers",
            "allowed_inbound": ["dmz", "internal"],
            "allowed_outbound": ["data_layer"],
            "trust_level": "semi-trusted"
        },
        "data_layer": {
            "description": "Databases and storage",
            "allowed_inbound": ["app_layer"],
            "allowed_outbound": [],
            "trust_level": "trusted"
        },
        "management": {
            "description": "Admin systems",
            "allowed_inbound": ["admin_vpn"],
            "allowed_outbound": ["all"],
            "trust_level": "highly_trusted"
        }
    }
    
    def get_allowed_traffic(self, from_zone: str, to_zone: str) -> bool:
        
        from_rules = .ZONES.get(to_zone, {}).get(, [])
         from_zone  from_rules    from_rules

Security Controls

Identity and Access Management

class IAMArchitecture:
    """Identity and Access Management"""
    
    def __init__(self):
        self.idp = "active_directory"  # or Okta, Auth0
        self.mfa_required = True
        self.session_timeout = 3600
    
    def authenticate(self, credentials: dict) -> dict:
        """Multi-factor authentication"""
        # Step 1: Primary auth
        user = self._verify_credentials(credentials)
        
        # Step 2: MFA
        if self.mfa_required:
            if not self._verify_mfa(user, credentials.get("mfa_token")):
                raise AuthenticationError("MFA required")
        
        # Step 3: Issue token
        return self._issue_token(user)
    
    def authorize(self, token: dict, resource: str, 
                  action: str) -> bool:
        """Attribute-based access control"""
        # Check permissions
        if not self._check_permission(token, resource, action):
             
        
        
          ._check_ownership(token, resource):
             
        
        
          ._check_context(token, resource):
             
        
         

Data Protection Architecture

class DataProtection:
    """Data classification and protection"""
    
    CLASSIFICATIONS = {
        "public": {
            "encryption_in_transit": False,
            "encryption_at_rest": False,
            "access_control": "none"
        },
        "internal": {
            "encryption_in_transit": True,
            "encryption_at_rest": True,
            "access_control": "authentication"
        },
        "confidential": {
            "encryption_in_transit": True,
            "encryption_at_rest": True,
            "access_control": "role_based"
        },
        "restricted": {
            "encryption_in_transit": True,
            "encryption_at_rest": True,
            "access_control": "explicit_grant"
        }
    }
    
    def protect_data(self, data: str, classification: str) -> dict:
        """Apply appropriate controls based on classification"""
        controls = self.CLASSIFICATIONS.get(classification, {})
        
        result = {
            "data": data,
            "classification": classification,
            "encrypted": controls.get("encryption_at_rest", )
        }
        
         controls.get():
            result[] = ._encrypt(data)
        
         result

Logging and Monitoring

class SecurityMonitoring:
    """Security event monitoring"""
    
    def __init__(self):
        self.alert_thresholds = {
            "failed_login": 5,
            "data_exfiltration_mb": 1000,
            "admin_action": 1,
            "privilege_escalation": 1
        }
    
    def log_event(self, event: dict):
        """Log security event"""
        event["timestamp"] = datetime.now()
        event["完整性校验"] = self._calculate_hash(event)
        
        # Check for alerts
        self._check_alerts(event)
    
    def _check_alerts(self, event: dict):
        """Check if event triggers alerts"""
        for alert_type, threshold in self.alert_thresholds.items():
            if event.get("type") == alert_type:
                if event.get("count", 1) >= threshold:
                    self._trigger_alert(event)

Threat Modeling

STRIDE Analysis

class ThreatModelSTRIDE:
    """STRIDE threat categories"""
    
    CATEGORIES = {
        "S": "Spoofing - Impersonating someone else",
        "T": "Tampering - Modifying data or code",
        "R": "Repudiation - Claiming to not have performed action",
        "I": "Information Disclosure - Exposing information",
        "D": "Denial of Service - Making system unavailable",
        "E": "Elevation of Privilege - Gaining capabilities"
    }
    
    def identify_threats(self, component: str) -> list:
        """Identify threats for a component"""
        threats = []
        
        if component == "authentication":
            threats.extend([
                ("S", "Credential theft"),
                ("R", "Failed login not logged"),
                ("I", "Passwords in logs")
            ])
        
        return threats